CDSME Data Collection Requirements and Procedures January 9, 2014 update

1. You Can! Live Well, Virginia! CDSME Data Collection Requirements and Procedures January 9, 2014 update

2. Some Housekeeping… • Be on the lookout for 3 questions scattered throughout this Powerpoint! • Forms are provided separately.

3. Overview of Today’s Training • NCOA Privacy and Security Basics for CDSME Data Collection • Implementation in Virginia • New/Updated Data Collection Procedures and Forms

4. Privacy and Security Basics for CDSME Data Collection • http://

5. Privacy Act of 1974 Public Law 93-579 (5 U.S.C.A. 552a) Privacy Act of 1974 Public Law 93-579 (5 U.S.C.A. 552a) • Purpose: to protect records that can be retrieved by personal identifiers such as a name, social security number, or other identifying number or symbol. • The act was created in response to concerns about how the use of computerized databases might impact individuals' privacy rights. • requires government agencies to show individuals any records kept on them • requires agencies to follow "fair information practices," when gathering and handling personal data. • places restrictions on how agencies can share an individual's data with other people and agencies. • lets individuals sue the government for violating of these provisions http://epic.org/privacy/1974act /

6. Who Needs to be Trained? Who Needs to be Trained? • If your work involves the management of sensitive information, PII (Personally Identifiable Information), or protected health information, you need to ensure you are taking precautions to protect it from unauthorized access/disclosure, theft, loss and improper disposal.

7. Types of Information Covered by the Privacy Act Types of Information Covered by the Privacy Act • Sensitive: if the loss of confidentiality, integrity, or availability could be expected to have a serious, severe or catastrophic adverse effect on organizational operations, organizational assets or individuals. • Protected Health Information: Individually identifiable health information that relates to a person’s past/present/future physical/mental health, health care received, or payment. http://irtsectraining.nih.gov/publicUser.aspx

8. Information Covered by the Privacy Act Information Protected by the Privacy Act PERSONALLY IDENTIFIABLE INFORMATION (PII) • Home address • Home telephone number • Complete date of birth • Personal medical information • Social Security Number (including just the last four digits of SSN) • Personal/private information (if the information can uniquely identify the individual) • Photographs • Education records • Financial transactions • Employment history

9. Information Protected by the Privacy Act Information Protected by the Privacy Act PERSONALLY IDENTIFIABLE INFORMATION (PII) "the term Personally Identifiable Information means any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.” http://www.gsa.gov/portal/content/104276

10. Disclosure Disclosure • No agency or person shall disclose: • any record • by any means of communication • to any person or another agency • without a written request or prior written consent of the individual to whom the record pertains • “any means of communication” includes oral (phone, in-person), written and electronic (emails, faxes, texts, tweets, pins, etc.) http://www.dodea.edu/upload/2011_patrainingslides.pdf

11. Safeguarding PII Safeguarding PII • PII must always be treated as “FOR OFFICIAL USE ONLY” and must be marked accordingly. • This applies not only to paper records (including e-mail, faxes, etc., which must contain the cautionary marking “FOR OFFICIAL USE ONLY – FOUO”). • All records containing PII should be stored in locked filing cabinets or other secure containers to prevent unauthorized access. • Electronic records must be password protected and be transferred via encrypted e-mail.

12. Transporting PII Transporting PII • Hand Carrying • Use a Cover sheet to shield contents • Using Mail • Use manila or white envelopes • Mark the envelope to the attention of the authorized recipient • Never indicate on the outer envelope that it contains PII • Using E-mail: • Password protect personal data placed on shared drives, the Internet or the Intranet • Use encrypted e-mail • Do not send PII to a personal, home or unencrypted e-mail address • Announce in the opening line of the text (NOT the subject line) that FOUO information is contained http://www.dodea.edu/upload/2011_patrainingslides.pdf

13. Disposing of PII Disposing of PII • A disposal method is considered adequate if it renders the information unrecognizable or beyond reconstruction. • Disposal methods may include: • Burning • Melting • Chemically decomposing • Pulping • Pulverizing • Shredding • Mutilating • Degaussing (erasing from magnetic field or disc) • Deleting/Emptying Recycle Bin www.dla.mil/.../Privacy%20Act%20103%20Safegarding%20Privacy%20

14. Question 1 • Information about an individual that is unique or identifies or describes him or her is called: • Interesting • Data • Record • Personally Identifiable Information

15. Answer • Information about an individual that is unique or identifies or describes him or her is called: • Personally Identifiable Information

16. Your Role and Responsibility Your Role and Responsibility • Respect privacy and take protection seriously • Ensure personal information is marked and e-mail is encrypted • Don’t share PII • Have appropriate transfer, storage and disposal protocols • Do not e-mail PII to personal, home or unencrypted accounts

17. Local Coordinator Role and Responsibility Your Role and Responsibility Manage Non-Disclosure Agreements • All individuals involved in providing CDSME programs • All individuals involved in data collection, data transfer and/or data entry • Maintained for 3-years after grant end • Stored by the state’s designee for data collection/data entry (Local Coordinator)

18. Master Trainer and Lay Leader Role Master Trainers and Lay Leader Role • CDSME Program Group Leader Script • Explains why participant data is being collected and how it will be kept secure • Emphasize that completing the survey is voluntary • Individuals may skip any questions they do not want to answer • Individuals may choose to not complete the Survey, and they can still participate in the program • Collect surveys and store forms in sealed envelope • Mail to appropriate program coordinator

19. Program Coordinator/Data Entry Role Program Coordinator/Data Entry Roles • Store completed CDSME forms in a secure, locked cabinet when not in use • Enter data into secure, password protected database, such as the CDSME database • Destroy participant data forms after data entry

20. Question 2 • Disposal methods may include all except: • Burning • Shredding • Tearing in half and putting in the garbage can • Melting

21. Answer • Disposal methods may include all except: • Tearing in half and putting in the garbage can

22. Implementation in Virginia You Can! Live Well, Virginia! Privacy and Security Basics for CDSME Data Collection Sue Lachenmayr, MPH, CHES http://www.ncoa.org/improve-health/center-for-healthy-aging/grantee-resources.html

23. Local Training Who needs training? • Master Trainers • Workshop Leaders • Data Collection/Data Entry Personnel • Any staff or volunteers with access to PII

24. Local Training Format: • Staff/volunteer views this PowerPoint • Local Coordinator reviews information on data collection procedures and forms with each leader • By telephone or in person • Leader/staff signs Non-Disclosure Agreement

25. Local Training Timeframe: • Training began November, 2013. • Leaders must complete before facilitating workshops beginning January 1, 2014 or later. • Can be phased in as long as leaders are trained before they facilitate workshops. • Use new procedures and forms for all workshops beginning January 1st, 2014.

26. Non-Disclosure Agreement • Signed by staff/volunteers after training. • Acknowledgement that participant information should not be shared with others and should be safeguarded appropriately.

27. Training Documentation Local Coordinator retains for 3 years after grant end (End date: September 1, 2018) • Non-Disclosure Agreement signed by each trainee. • List of trainees with dates of training for local use. • Report only number of trained staff/volunteers to DARS.

28. At Workshop: Forms and Materials • Attendance Log: Updated • Group Leader Script: NEW • Participant Information Survey: Updated • Workshop Information Cover Sheet: Updated

29. At Workshop: Attendance Log • Leaders fill in attendance, using first name and last initial only. • If duplicate names (e.g. Barbara T.), use middle initial or differentiate names in another manner. • Leaders keep track of attendance at each session. • Goes to Local Coordinator at end of workshop.

30. Key Points: Group Leader Script • Survey completion is optional and not required for participation in workshop • Participants can decide not to complete survey at all • Workshop leaders should not push one way or the other

31. Question 3 • The CDSME Group Leader Script: • Please select all that apply • Describes what the participants will learn in the • workshop • Requests participants to share address, birth • date and sex • Explains how participant privacy is protected • Explains why data is being collected • Emphasizes that participants must complete all survey forms

32. Answer • The CDSME Group Leader Script: • Explains how participant privacy is protected • Explains why data is being collected

33. Participant Information Survey • Participant “gender” now reads “sex” • Participant race- no longer an “other” category • Chronic conditions added to match database • Questions on caregiver status, disability status, and educational attainment added • “Have you taken this workshop before?” removed • Available in Spanish • Destroy form immediately after entering data into database

34. Workshop Information Cover Sheet • Updated • Database updated to match form. • Includes all languages available. • LC provides extra copies of Page 1 to leaders so they can send with mailings of completed forms. • Can destroy immediately after entering data in the database.

35. At Workshop: Data Collection • After welcoming participants at first session, leaders: • Distribute Participant Information Surveys. • Read aloud Group Leader Script. • Participants complete (or decline to complete) survey forms.

36. After Session 1: Data Collection Procedures Leaders: • Complete highlighted areas of Workshop Information Cover Sheet, page 1. • Place this with completed Participant Information Surveys in stamped, pre-addressed and sealed envelope. • Place envelope in nearest mailbox immediately after workshop session. • If they can’t be mailed immediately they must be stored in locked container.

37. After Session 2: Data Collection Procedures If participant joins workshop at 2nd session, leaders: • Provide Participant Information Survey and read Group Leader Script to new participant(s). • Follow same procedure for collecting and mailing as described previously.

38. Supplies and Equipment What supplies/equipment are needed? • Pre-addressed and stamped mailing envelopes • Locked file cabinets or secure containers to store any records containing PII

39. Other: Data Collection Procedures • Additional information collected at the local level (e.g. contact information) used to carry out the program must be stored in a secure manner. • This information should not be shared with others and should be safeguarded appropriately.

40. Prison Populations • Use Attendance Log only: First name and last initial only • Do not use Participant Information Surveys

41. Data Destruction • Local Coordinators must destroy completed Participant Information Surveys once the data is entered in the database and checked over.

42. Other What about evaluation forms? (Feedback, Pre and Post Assessments) • None required at this time • Local programs may choose to continue using Participant Feedback Form

43. Questions? Contact your local coordinator or April Holmes at 804-662-7631 april.holmes@dars.virginia.gov

44. The End Thank you!